CVE-2024-5009: WhatsUp Gold SetAdminPassword Improper Access Control Privilege Escalation Vulnerability
In WhatsUp Gold versions released before 2023.1.3, an Improper Access Control vulnerability in Wug.UI.Controllers.InstallController.SetAdminPassword allows local attackers to modify admin's password.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WhatsUp Goldto a version that resolves this vulnerability.Fixed in 2023.1.3
Event History
Frequently Asked Questions
What is the severity of CVE-2024-5009?
CVE-2024-5009 has a high severity rating due to the potential for local attackers to gain unauthorized access to the admin's password.
How do I fix CVE-2024-5009?
To fix CVE-2024-5009, update your WhatsUp Gold installation to version 2023.1.3 or later.
Who is affected by CVE-2024-5009?
CVE-2024-5009 affects all versions of WhatsUp Gold prior to 2023.1.3.
What can attackers do with CVE-2024-5009?
Local attackers can modify the admin's password, potentially leading to unauthorized administrative access.
When was CVE-2024-5009 reported?
CVE-2024-5009 was reported in June 2024 as part of the security bulletin for WhatsUp Gold.